Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-8202

Authorize Oauth apps through CLI doesn't work anymore

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • quay-v3.12.0
    • quay
    • False
    • None
    • False
    • Quay Enterprise

      It seems that delegation of Oauth tokens broke workflow for authorization of apps through CLI. When tried, the following exception is raised:

      gunicorn-web stdout | 2024-11-07 13:58:04,378 [254] [ERROR] [gunicorn.error] Error handling request /oauth/authorize?response_type=token&client_id=7CA3OCARR94XMQUP66CU&scope=org%3aadmin+repo%3aadmin+repo%3acreate+repo%3aread+repo%3awrite+super%3auser+user%3aadmin+user%3aread&redirect_uri=https%3a%2f%2fquay.skynet%2foauth%2flocalapp
      gunicorn-web stdout | Traceback (most recent call last):
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/gunicorn/workers/base_async.py", line 55, in handle
      gunicorn-web stdout |     self.handle_request(listener_name, req, client, addr)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/gunicorn/workers/ggevent.py", line 128, in handle_request
      gunicorn-web stdout |     super().handle_request(listener_name, req, sock, addr)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/gunicorn/workers/base_async.py", line 108, in handle_request
      gunicorn-web stdout |     respiter = self.wsgi(environ, resp.start_response)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/flask/app.py", line 2213, in __call__
      gunicorn-web stdout |     return self.wsgi_app(environ, start_response)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/werkzeug/middleware/proxy_fix.py", line 183, in __call__
      gunicorn-web stdout |     return self.app(environ, start_response)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/flask/app.py", line 2193, in wsgi_app
      gunicorn-web stdout |     response = self.handle_exception(e)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/flask_restful/__init__.py", line 298, in error_router
      gunicorn-web stdout |     return original_handler(e)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/flask/app.py", line 2190, in wsgi_app
      gunicorn-web stdout |     response = self.full_dispatch_request()
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/flask/app.py", line 1486, in full_dispatch_request
      gunicorn-web stdout |     rv = self.handle_user_exception(e)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/flask_restful/__init__.py", line 298, in error_router
      gunicorn-web stdout |     return original_handler(e)
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/flask/app.py", line 1484, in full_dispatch_request
      gunicorn-web stdout |     rv = self.dispatch_request()
      gunicorn-web stdout |   File "/app/lib/python3.9/site-packages/flask/app.py", line 1469, in dispatch_request
      gunicorn-web stdout |     return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
      gunicorn-web stdout |   File "/quay-registry/util/cache.py", line 36, in add_no_cache
      gunicorn-web stdout |     response = f(*args, **kwargs)
      gunicorn-web stdout |   File "/quay-registry/endpoints/decorators.py", line 112, in decorated
      gunicorn-web stdout |     return wrapped(*args, **kwargs)
      gunicorn-web stdout |   File "/quay-registry/endpoints/decorators.py", line 112, in decorated
      gunicorn-web stdout |     return wrapped(*args, **kwargs)
      gunicorn-web stdout |   File "/quay-registry/endpoints/decorators.py", line 112, in decorated
      gunicorn-web stdout |     return wrapped(*args, **kwargs)
      gunicorn-web stdout |   File "/quay-registry/auth/decorators.py", line 69, in wrapper
      gunicorn-web stdout |     return func(*args, **kwargs)
      gunicorn-web stdout |   File "/quay-registry/endpoints/web.py", line 743, in request_authorization_code
      gunicorn-web stdout |     not is_org_admin(current_user.db_user().username, oauth_app.organization)
      gunicorn-web stdout | AttributeError: 'AnonymousUserMixin' object has no attribute 'db_user'
      gunicorn-web stdout | 2024-11-07 13:58:04,380 [254] [INFO] [gunicorn.access]  - - [07/Nov/2024:13:58:04 +0000] "GET /oauth/authorize?response_type=token&client_id=7CA3OCARR94XMQUP66CU&scope=org%3aadmin+repo%3aadmin+repo%3acreate+repo%3aread+repo%3awrite+super%3auser+user%3aadmin+user%3aread&redirect_uri=https%3a%2f%2fquay.skynet%2foauth%2flocalapp HTTP/1.0" 500 0 "-" "-"
      

      There are significant changes in code between 3.11 where the CLI workflow for the client works vs 3.12 where it doesn't work anymore.

      Relevant function:
      https://github.com/quay/quay/blob/0059596572189b4cba2955149358102e3b192576/endpoints/web.py#L711-L810

      Please check! Thank you!

              bcaton@redhat.com Brandon Caton
              rhn-support-ibazulic Ivan Bazulic
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: